Tor

Tor is an encrypted anonymising network that makes it harder to intercept internet communications, or see where communications are coming from or going to.

In order to use the WikiLeaks public submission system as detailed above you can download the Tor Browser Bundle, which is a Firefox-like browser available for Windows, Mac OS X and GNU/Linux and pre-configured to connect using the anonymising system Tor.

Tails

If you are at high risk and you have the capacity to do so, you can also access the submission system through a secure operating system called Tails. Tails is an operating system launched from a USB stick or a DVD that aim to leaves no traces when the computer is shut down after use and automatically routes your internet traffic through Tor. Tails will require you to have either a USB stick or a DVD at least 4GB big and a laptop or desktop computer.

Tips

Our submission system works hard to preserve your anonymity, but we recommend you also take some of your own precautions. Please review these basic guidelines.

1. Contact us if you have specific problems

If you have a very large submission, or a submission with a complex format, or are a high-risk source, please contact us. In our experience it is always possible to find a custom solution for even the most seemingly difficult situations.

2. What computer to use

If the computer you are uploading from could subsequently be audited in an investigation, consider using a computer that is not easily tied to you. Technical users can also use Tails to help ensure you do not leave any records of your submission on the computer.

3. Do not talk about your submission to others

If you have any issues talk to WikiLeaks. We are the global experts in source protection – it is a complex field. Even those who mean well often do not have the experience or expertise to advise properly. This includes other media organisations.

After

1. Do not talk about your submission to others

If you have any issues talk to WikiLeaks. We are the global experts in source protection – it is a complex field. Even those who mean well often do not have the experience or expertise to advise properly. This includes other media organisations.

2. Act normal

If you are a high-risk source, avoid saying anything or doing anything after submitting which might promote suspicion. In particular, you should try to stick to your normal routine and behaviour.

3. Remove traces of your submission

If you are a high-risk source and the computer you prepared your submission on, or uploaded it from, could subsequently be audited in an investigation, we recommend that you format and dispose of the computer hard drive and any other storage media you used.

In particular, hard drives retain data after formatting which may be visible to a digital forensics team and flash media (USB sticks, memory cards and SSD drives) retain data even after a secure erasure. If you used flash media to store sensitive data, it is important to destroy the media.

If you do this and are a high-risk source you should make sure there are no traces of the clean-up, since such traces themselves may draw suspicion.

4. If you face legal action

If a legal action is brought against you as a result of your submission, there are organisations that may help you. The Courage Foundation is an international organisation dedicated to the protection of journalistic sources. You can find more details at https://www.couragefound.org.

Submit documents to WikiLeaks

WikiLeaks publishes documents of political or historical importance that are censored or otherwise suppressed. We specialise in strategic global publishing and large archives.

The following is the address of our secure site where you can anonymously upload your documents to WikiLeaks editors. You can only access this submissions system through Tor. (See our Tor tab for more information.) We also advise you to read our tips for sources before submitting.

wlupld3ptjvsgwqw.onion

Copy this address into your Tor browser. Advanced users, if they wish, can also add a further layer of encryption to their submission using our public PGP key.

If you cannot use Tor, or your submission is very large, or you have specific requirements, WikiLeaks provides several alternative methods. Contact us to discuss how to proceed.

Vault 7: CIA Hacking Tools Revealed

Grasshopper Design

Note: Grasshopper is currently being updated for v2.0. This page documents the working v2.0 design. As such, it is subject to change at any time.

Background

Grasshopper is a modular tool used to install software IOInformation Operations tools on targets running Microsoft Windows operating systems. Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). Installers may be configured with rules that will be evaluated on target to determine whether to conduct an install.

Overview

A Grasshopper contains one or more installers. An installer is a stack of one or more installer components. Grasshopper invokes each component of the stack in series to operate on a payload. The ultimate purpose of an installer is to persist a payload.

Grasshopper will optionally evaluate rules to determine whether to execute an installation. Rules may be set on each installer and/or globally.

Definitions

Installer

Installers encapsulate the process used to install a payload on a target. They are constructed from one or more components that each contribute to the installation process.

An installer may have an associated rule that will be evaluated before execution.

Component

Components form the functional portions of an installer. Components may be used to introduce payloads to the installer stack, modify a payload in the stack, or install a payload on a target. A component script is used at build time to generate a configuration that stores component data specific to an installler. A Grasshopper installer executes a component module at run time to perform some operation on the payload. The module is provided the configuration generated by the script.

Components may be independently developed and added to a Grasshopper system.

Script

A component script is a Python package that interfaces with the Grasshopper builder.

Configuration

A component configuration is a data store provided to the component to save information necessary to execute an installation step. The configuration is generated by the script at buildtime and provided to the module at runtime. A configuration is generated for each use of a component.

The format of the configuration data is component-specific.

Module

A module is a Windows DLLDynamic Link Library that provides runtime functionality for an installer component. At runtime, modules are provided a configuration and, optionally, an input payload from the previous component. Modules may return an output payload which will be passed to the next component.

The component must provide modules for each Grasshopper architecture.

Payload

Payloads are the tools that an installer is meant to install on a target. A payload is passed to each installer component in series to perform some component-specific action. The first component is responsible for starting the payload on the installer stack and should not expect one as input. The last component is responsible for finishing the payload on the stack and should not return one as output.

Payloads are typed by format (EXE, DLL, etc.) and architecture (x86, x64, etc.). At buildtime, the input and output types of each component are validated against the input and output types of its neighbors in the stack.

Interfaces

Component Modules

The component module interface requires that the module DLLDynamic Link Library expose functions that perform a set of procedures.

Install Procedure

The component install procedure is called by Grasshopper during the execution of a configured installer.

The input payload may be modified in place and the output payload pointer set to the input payload pointer.

If more space is needed for the output, the module is responsible for allocating this buffer. The memory should be allocated as read-write.

output_payload_size

- pointer to size of the output payload in bytes

The uninstall procedure returns a boolean indicating whether the install procedure was completed successfully. If a component returns TRUE, the installation continues. If a component returns FALSE, Grasshopper will call the uninstall procedure on each component module that was called successfully in reverse order.

Uninstall Procedure

The component uninstall procedure is called by Grasshopper when trying to reverse an installer.